Privacy Policy

Effective June 2, 2026

Kingdoms & Crowns (“we,” “us,” or “the app”) is a homeschool learning-log tool used by parents to track their children’s educational activities. This policy explains what we collect, why, and the choices you have. We tried to write this in plain language; where we use legal terms we’ve done so because we think they protect you, not us.

Quick summary: Only the parent has an account. Children are profiles managed by the parent and never sign in directly. We don’t sell your data, we don’t use it for advertising, and we don’t share it with third parties beyond the service providers strictly necessary to run the app.

1. Who the app is for

Kingdoms & Crowns is designed for parents and guardians who homeschool school-age children. Account holders must be at least 18 years old. Children do not create accounts and we do not collect personal data directly from children — all child information is entered by the parent.

2. Information we collect

Parent (account holder) information

Name and email address you provide at sign-up, or that Google shares with us if you sign in with Google (name, email, profile image, Google account ID).
An encrypted hash of your password if you choose email/password sign-in. We never see or store your plaintext password.
Family name and time zone you configure in settings.

Child profile information (entered by the parent)

Display name (a first name or nickname — we recommend not using a full legal name).
Birth year (used to set age-appropriate features).
A short numeric PIN, stored as an encrypted hash, used so the right child can sign on to their own profile from the parent’s session.
Avatar configuration and any learning subjects you create for the child.

Learning activity

Quest titles, descriptions, time spent, completion status, and notes you or your child enter.
Weekly summaries, badges earned, XP, streaks, and other gameplay state.
Teacher feedback text you choose to paste in, and any draft responses you write.

Technical information

Session cookies required to keep you signed in.
IP address and user-agent string of devices that authenticate, used for security and abuse prevention.
Server logs of errors and unusual activity.
If you send us feedback through “Send a Raven,” we capture the page you were on, your viewport size, and the user-agent string along with your message — to help us reproduce bugs.

3. How we use the information

To operate the app: show your family their quests, log activity, award badges, generate weekly summaries.
To authenticate you and keep your account secure.
To send transactional emails such as password resets and (if you opt in) quest reminders.
To respond to feedback and support requests you initiate.
To diagnose and fix bugs and to improve features based on aggregate, non-identifying usage patterns.

We do not use your data to train advertising profiles, sell it to data brokers, or expose it to third parties for marketing.

4. Children’s privacy

Because the app is designed for parental use, all child information is provided and managed by the parent under their own account. We treat child profile data as belonging to the parent’s account and apply the same protections to it as to the parent’s own information. We do not knowingly accept accounts created by children, and we do not collect data from children through any direct channel (such as ads, social features, or open chat).

If you are a parent and you would like to review, export, or delete information about your child held in the app, you can do so from the Hearth (settings) page or by contacting us at the address below.

5. Service providers we use

Turso (libSQL hosting) — stores your account, family, and learning data.
Vercel — hosts and serves the app.
Google — only if you choose “Continue with Google” to sign in; Google shares your name, email, profile picture, and Google account ID with us.
Resend — sends transactional emails (password reset, quest reminders, feedback acknowledgements).

Each provider is contractually limited to processing your data on our behalf for the purposes listed above.

6. How long we keep data

Account and family data: kept while your account is active.
Learning activity: kept while your account is active, so you can produce weekly summaries and longitudinal records.
Session records: deleted on sign-out or when they expire.
Feedback messages: kept indefinitely so we can correlate issues across releases.

When you delete your account, we delete your account, family, child profiles, and learning activity within 30 days, except where we are required to keep limited records to comply with law or resolve disputes.

7. Your choices

Access & export: You can view all data stored about your family inside the app. Email us if you need a machine-readable export.
Correction: Update any information in the Hearth (settings) page.
Deletion: Delete individual child profiles in settings; email us to delete your entire account.
Opt out of optional emails: Quest reminders and other non-essential notifications can be disabled in notification preferences.
Sign-in choice: You can sign in with email/password or with Google; you can switch between them by contacting us.

8. Security

We use industry-standard practices: encrypted transport (HTTPS), bcrypt-hashed passwords and PINs, scoped database access, and strict same-origin / no-frame headers on all pages. No system is perfectly secure; if we ever discover a breach affecting your data, we will notify you promptly and follow applicable law.

9. International users

The app is operated from the United States and your data is stored on infrastructure that may be located in the U.S. or other countries where our service providers operate. By using the app, you consent to this transfer.

10. Changes to this policy

We may update this policy as the app evolves. When we make material changes, we will update the “Effective” date at the top and notify you in the app or by email before the change takes effect.

11. Contact

Questions, requests, or concerns? Email us at privacy@kingdomsandcrowns.com.